As we just saw, the search command allows us to quickly find the right exploit.
Now we need to configure that exploit module for our target system.
Once we have our exploit modules selected, it needs to be configured.
There are generally three steps in configuring an exploit module.
There are options that may need to have their value set or
changed, targets to be selected, and a payload.
Earlier in the course,
we showed the commands that are used to configure exploit modules.
We will show how to use those commands in a demonstration a little later.
When you run the show options command,
you'll see information about the available options.
First, you'll see the name of the option, along with its current value.
Blank entries mean that there is no value set.
There's an indication as to whether the option is
required and has to have a value.
The most obvious example is RHOSTS. And then a description of the
module and sometimes details on how to set it.
There are two types of module options.
Basic options are those that are displayed when you run the show options
command. These are the options that are required for an exploit or any module to
have values configured in order to execute successfully.
Advanced options are those that are displayed with the show advanced command.
These are low‑level options for internal operations of modules.
In most cases, you won't need to make any changes here,
but there might be a case where you do. These are
typically used when developing exploits,
debugging problems, or tweaking the operations in order to get
an exploit to work against a specific target.
Vulnerabilities may affect only one very specific piece of software,
or it could be a vulnerability that is found in many different ones.
Exploit modules in the Metasploit Framework typically target one vulnerability,
but one or more targets.
We generally need to know when and where the exploit
can be applied to our targets.
Some exploits have only one target type.
This is typical for vulnerabilities that affect a small number of
software versions or a single vulnerability.
Other available target listings have a very long and
very specific list of targets.
These might have exploit code that is specific to each target.
Some exploits have automatic targeting. These may be
exploits that are not code specific.
There are also very specific targets.
Some are listed by operating system, such as Windows,
Linux, or a specific flavor of Linux.
There are also vulnerabilities that are specific to the version of software,
a Windows service pack,
a release version, or even a specific language of the system.
Some have processor‑specific code,
either for 32‑bit or 64‑bit processors, or the environment in
which the software runs has specific targets.
These could be targets that run in specific virtual machine types, for
example. If the target has a specific type of exploit protection
enabled, such as address space, layout randomization, or data execution
protection features enabled, there are target types that will attempt to
bypass those protections.
Some targets have different techniques to exploit a specific vulnerability.
They may use some intermediate software packages to exploit that vulnerability,
which sometimes is the case for specific client‑side attacks, or they may
create a file or code that needs to be delivered to the target.
Check functions are implemented in some, but not all exploit modules.
When it is available, it can help answer some basic questions
about the exploit module and the target.
First is the module configured correctly for this
target? Do I have the right target?
Is the target service for this exploit running on the target and responding?
Does this one have the vulnerability?
All of this is needed to give us a level of confidence that
we have the right target system, service, and the right
configuration to be successful.
Before we can launch the exploit,
we need to tie it to a payload to deliver to the system once the issue
is exploited. When we select an exploit for use,
a payload is automatically selected.
Metasploit uses a list of payloads to choose from.
Usually it will pick Meterpreter whenever possible.
Depending on the vulnerability, the available payloads might be limited.
This could be due to limitations on payload size or
the nature of the vulnerability.
Each payload generally has some options that can be configured.
If a reverse network connection from the target system is
made back to your Metasploit system,
you have to at least set the LHOST option to the correct IP address.
Earlier in the course,
we showed the payload‑related commands for finding
and configuring payload modules.
We'll be using those commands next.